Reads the Content-Security-Policy header of a site's home page and lists weak points: 'unsafe-inline' and 'unsafe-eval' in script sources, bare wildcards, data: or http: script sources, a missing default-src or script-src, and a missing policy altogether. Reports directives. Header only; a CSP in a meta tag is not read.